Dashboards & Visualizations

Dashboard timechart label does not pass on to drilldown query

ashrafsj
Path Finder

Hi All,

I have an dashboard that has is a time chart and when I drilldown the server name, it has to fetch details from the DBX query. Instead of search servername in the dbx query, i tried to use token value to pass the server name from the timechart.

   |search $tokvalue_XX$ 

On Main panel,

       <drilldown>
          <set token="tokvalue_XX">$click.name2$</set>
          <set token="clicked_earliest">$earliest$</set>
          <set token="clicked_latest">$latest$</set>
        </drilldown>

For the drilldown part,

<row depends="$tokvalue_XX$">
    <panel>
      <title>Drilldown - $tokvalue_XX$ from $clicked_earliest$ to $clicked_latest$</title>
      <table>
        <search>
          <query>| dbxquery connection="CONN" query="SELECT QUERY" shortnames=true | search \"\*$$tokvalue_XX$$\*\"
| table SERVER, PROCESS,SQL_ID,PREV_SQL_ID,"Lock offset","Elapsed Time Secs"</query>
          <earliest>$clicked_earliest$</earliest>
          <latest>$clicked_latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>

When I click on the server name from the timechart on the server name, the second window just shows but doesn't pull any data based on the query. The query works when its being passed with the servername in Splunk and DB connect.

I have tried passing the value as $$tokvalue_XX$$ or $tokvalue_XX$ or "$tokvalue_XX$"

Labels (2)
0 Karma

maityayan1996
Path Finder

Testing

<input type="time" token="time" searchWhenChanged="true">
  <label>timerange</label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <table>
    <search>
      <query>index=_internal sourcetype=splunkd_ui_access | stats count by method</query>
      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">100</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">row</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
    <drilldown>
       <set token="tokvalue_XX">$click.name2$</set>
       <set token="clicked_earliest">$time.earliest$</set>
       <set token="clicked_latest">$time.latest$</set>
    </drilldown>

  </table>
</panel>
    <panel depends="$tokvalue_XX$">
  <table>
    <search>
      <query>index=_internal sourcetype=splunkd_ui_access |timechart count by $tokvalue_XX$</query>
      <earliest>$clicked_earliest$</earliest>
      <latest>$clicked_latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">100</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">none</option>
    <option name="percentagesRow">false</option>
    <option name="refresh.display">progressbar</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
</panel>
0 Karma

maityayan1996
Path Finder

Use the token in this way. Here "time" is the token name which I have mentioned for the time input option. In this way you can take the reference of the "time" from the main panel. Please mark as answered once you resolve this issue.

0 Karma

ashrafsj
Path Finder

Sorry for late reply, my query worked for me, as I tried to test the dashboards separately and integrated the drilldown later. Not sure if there was some spacing issues when I initially tried. So I made a separate dashboard with the drilldown query to test if it worked and then moved that query part into the main drilldown panel.

Thanks,
Ashraf

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...